Improper Restriction of Excessive Authentication Attempts in Siemens products - CVE-2022-24044
Published: May 11, 2022
Vulnerability identifier: #VU63068
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-24044
CWE-ID: CWE-307
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Siemens
Affected software:
Desigo DXR2
Desigo PXC3
Desigo PXC4
Desigo PXC5
Desigo DXR2
Desigo PXC3
Desigo PXC4
Desigo PXC5
Detailed vulnerability description
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the login functionality of the application does not employ any countermeasures against Password Spraying attacks or Credential Stuffing attacks. A remote attacker can gain unauthorized access to sensitive information on the system.
How to mitigate CVE-2022-24044
Install updates from vendor's website.